Sophos XG Firewall New Deployment - No Internet Access

Hi,

what rules and NAT do you have in place? What addresses do your interfaces show? Do you have a gateway included in your WAN interface?

Ian

wan and lan interfaces as below [please note i have unplugged wan atm], to get pfsense working to get internet;

firewall rules, have created a new one, right at the top; 

 and NAT rules are as below; [appears to be default nat rules]

Sounds like a more fundamental problem then. Are you sure your 1RU has Sophos-supported NICs? Are you sure the WAN port is in fact a WAN port? It could be anything from non-supported hardware to Sophos numbering your ports differently.

Likely it is not a Sophos Problem? 
You are using the same kind of IP Address. Check the Switch, if you actually get any kind of reply or if the Switch is confused due the duplicated IP. 

You can check the packet capture on the Sophos to check, if there are actually any kind of Internet Packets. 

when I deploy sophos, i have removed switch for now. I can see which ones are connected/plugged to which ones are accessible as lan. will update screenshots later on 2nite,

can we not changed the wan ports around? i can clearly see/identify which ports are lan/wan.

i shall try again and see if it makes a difference. although I am trying to install the xg firewall software.

https://www.sophos.com/en-us/free-tools/sophos-xg-firewall-home-edition

according to above, I didn't see anything about supported hardware.

Hi,

if you are using Sophos hardware with a software licence the ports are the ports are numbered usually in reverse order.

Ian

Motherbaord is; X11SSH-F  https://www.supermicro.com/en/products/motherboard/x11ssh-f

and has 2 onboard nics: 

 that's the network card on the motherboard

Wondering: The modem you are using: Did you do a tcpdump on WAN? Maybe the modem is using a MAC locking, therefore if you change the appliance, it will not answer to the ARP anymore. 

It's a straight ont fibre to copper device, simple power off/on, does the trick. I tried plugging in the fritzbox and another router, and it gets the ip successfully [which is a static allocation from ISP]

What about the packet capture? Did you do this? 

What about the packet capture? Did you do this? 

No, i haven't, I'll try tomorrow, as I have sourced a 4port intel PRO/1000 PT, as I'm leaning towards onboard nics being the issue.

also, not sure where to do the packet capture from?

You can do a general packet capture from the SFOS webadmin under Diagnostic.

Then check if you see any kind of packets and what kind of packets on which ports. 

BTW: If you check for the IP: Check if your interface is actually connected or not. If it is unplugged, you might use the wrong interface on SFOS: 

I have added a 4port Intel network card, and not using the onboard nics.

I can now get wan via dhcp, and works fine. 

Now i need to figure out, why it wouldn't work without a nat rule. any hints will be highly appreciated. thanks,